Find similar analyses in TI Lookup

Analysis date (UTC): 25 March 2019, 10:37Analysis environment: Windows 7 Pro, build 7601, x86

ACC_E85297.doc

MD5:3DD60690ECC0F589BB58E44866640596

SHA1:3906379891EA7659C15192C2CF062E239B1B3AF0

SHA256:68BC255F9B0DB6A0D30A8F2DADFBEE3256ACFE12497BF93943BC1EAB0735E45E

Analysis result

Threat level:Malicious activity

Tags:

macrosmacros-on-opengenerated-docloaderemotetemotet-doc

Full analysis:Analysis ACC_E85297.doc (MD5: 3DD60690ECC0F589BB58E44866640596) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

859.exe (PID: 2168)
859.exe (PID: 3124)
wabmetagen.exe (PID: 1584)
wabmetagen.exe (PID: 3156)

Downloads executable files from the Internet

powershell.exe (PID: 1956)

Emotet process was detected

wabmetagen.exe (PID: 1584)

SUSPICIOUS

Executable content was dropped or overwritten

powershell.exe (PID: 1956)
859.exe (PID: 3124)

Creates files in the user directory

powershell.exe (PID: 1956)

Application launched itself

859.exe (PID: 2168)
wabmetagen.exe (PID: 1584)

Starts itself from another location

859.exe (PID: 3124)

INFO

Reads Microsoft Office registry keys

WINWORD.EXE (PID: 3864)

Creates files in the user directory

WINWORD.EXE (PID: 3864)

Threats

PID	Process	Class	Message
1956	powershell.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
1956	powershell.exe	Potentially Bad Traffic	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1956	powershell.exe	Misc activity	ET INFO EXE - Served Attached HTTP